CVE catalog

CVE-2020-10729

ansible: CVE-2020-10729

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianansiblesid14.4.0+dfsg-1fixed
Debianansibleforky14.0.0+dfsg-1fixed
Debianansibletrixie12.0.0+dfsg-0+deb13u1fixed
Debianansiblebookworm7.7.0+dfsg-3+deb12u1fixed
Ubuntuansiblepro2.3.1.0+dfsg-2vulnerable
Ubuntuansiblepro2.5.0+dfsg-1vulnerable
Ubuntuansiblepro2.5.1+dfsg-1vulnerable
Ubuntuansiblepro2.5.1+dfsg-1ubuntu0.1vulnerable
Ubuntuansiblepro2.5.1+dfsg-1ubuntu0.1+esm1vulnerable
Ubuntuansiblepro2.5.1+dfsg-1ubuntu0.1+esm2vulnerable
Ubuntuansiblepro2.5.1+dfsg-1ubuntu0.1+esm3vulnerable
Ubuntuansiblepro2.5.1+dfsg-1ubuntu0.1+esm4vulnerable
Ubuntuansiblepro2.5.1+dfsg-1ubuntu0.1+esm5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianansiblesourcesid2.9.6+dfsg-1not yet assignedNot reportedNot reported
Debianansiblesourceforky2.9.6+dfsg-1not yet assignedNot reportedNot reported
Debianansiblesourcetrixie2.9.6+dfsg-1not yet assignedNot reportedNot reported
Debianansiblesourcebookworm2.9.6+dfsg-1not yet assignedNot reportedNot reported
Ubuntuansibledebpro2.5.1+dfsg-1ubuntu0.1+esm5Not reportedUBUNTU-CVE-2020-10729Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ansible]Fixed
    Details (2)

    • 7.7.0+dfsg-3+deb12u1 · all · bookworm

      Fixed · Fixed: 2.9.6+dfsg-1

      dsa · ansible · debian · bookworm; dsa · ansible · debian · 12

    • 7.7.0+dfsg-3+deb12u1 · all · bookworm

      Fixed · Fixed: 2.9.6+dfsg-1

      dsa · ansible · debian · bookworm; dsa · ansible · debian · 12

[Debian 13 (Trixie)]

  • [ansible]Fixed
    Details (2)

    • 12.0.0+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 2.9.6+dfsg-1

      dsa · ansible · debian · 13

    • 12.0.0+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 2.9.6+dfsg-1

      dsa · ansible · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]